Chinese Cybercriminals Take Advantage of Undisclosed Cisco Switch Vulnerability to Attain System Control
Information has surfaced about a Chinese hacker group’s manipulation of a recently exposed, now fixed vulnerability in Cisco switches as a zero-day vulnerability to attain authority over the device and avoid detection.
The operation, credited to Velvet Ant, was identified earlier this year and involved the exploitation of CVE-2024-20399 (CVSS score: 6.0) to distribute customized malware and acquire complete control over the compromised system, which allowed for both stealing data and maintaining continuous access.
“The zero-day exploit enables a hacker with valid administrator credentials to the Switch management console to escape the NX-OS command line interface (CLI) and run arbitrary commands on the Linux underlying operating system,” cybersecurity firm Sygnia stated in a report shared with The Hacker News.
Velvet Ant initially attracted the attention of experts at an Israeli cybersecurity corporation concerning a prolonged campaign targeting an undisclosed organization in East Asia by leveraging outdated F5 BIG-IP appliances to establish persistence in the compromised environment.
The operational conduct of the threat actor exploiting CVE-2024-20399 was revealed early last month, leading Cisco to publish security updates to eliminate the vulnerability.
Among the strategies, the group’s noteworthy approach is the level of complexity and adaptive methods used, initially infiltrating fresh Windows systems and then moving to outdated Windows servers and network devices in an effort to remain inconspicuous.
“The shift to operating from internal network devices signifies a further escalation in the evasion methodologies employed to ensure the espionage campaign’s continuity,” Sygnia added.
The latest attack sequence involves breaching a Cisco switch appliance via CVE-2024-20399 and conducting surveillance tasks, later transitioning to other network devices and ultimately executing a backdoor binary using a malicious script.
The payload, named VELVETSHELL, is a fusion of two open-source utilities, a Unix backdoor labeled Tiny SHell and a proxy tool known as 3proxy. It also enables the execution of arbitrary commands, file download/upload, and the establishment of network traffic proxy tunnels.
“The approach of ‘Velvet Ant’ raises concerns and uncertainties regarding third-party appliances and applications that organizations adopt,” the firm noted. “Due to the ‘black box’ nature of many appliances, each piece of hardware or software could potentially become the attack vector exploited by an adversary.”
About Author
